# Third-party distribution register

This register identifies every third-party executable file distributed from
`scripts/vendor/`, plus every version-pinned runtime download. SHA-256 values
apply to the files in this repository. Replace a listed file only together
with this register and `credits.html`.

Files ending in `.d.ts` and `.map` are development metadata. They are listed
at the end of this document and are not runtime dependencies.

## Locally distributed WebAssembly components

### heic-to 1.4.2

- License: LGPL-3.0-or-later; its bundled decoder uses LGPL-licensed libheif and libde265.
- Copyright: Hopper Gee; Struktur AG and Dirk Farin (libheif); Struktur AG (libde265).
- Source: <https://github.com/hoppergee/heic-to/tree/v1.4.2>, <https://github.com/strukturag/libheif>, and <https://github.com/strukturag/libde265>.
- Runtime file: `scripts/vendor/heic-to.js` — SHA-256 `bf8d6cd1426195a4ad66050d6f6debcd9528753a2a1e1871d3b6ee404c731b09`.

### libraw-wasm 1.4.0

- License: ISC for the JavaScript wrapper. Bundled LibRaw is distributed under the LGPL-2.1-or-later option of its dual license.
- Copyright: ybouane and contributors; LibRaw LLC; Dave Coffin for dcraw-derived code.
- Source: <https://github.com/ybouane/LibRaw-Wasm/tree/3cbd8aa5f8c10f68a7dc60b5a4aa23b00113d888> and <https://github.com/LibRaw/LibRaw>.
- Runtime files:
  - `scripts/vendor/libraw-wasm/index.js` — SHA-256 `e601aecc399e7e2f261900ccb9b022ae32106ea273234891011b1447682d664e`.
  - `scripts/vendor/libraw-wasm/libraw.js` — SHA-256 `fee75037a107535d686435b6308f946a0d5454e8c52e059c6c768a2ade016a53`.
  - `scripts/vendor/libraw-wasm/libraw.wasm` — SHA-256 `573bdd72b31da6b5a8b63e6e15761bc4431cc8a6a1577e7b99bea2add1b240c4`.
  - `scripts/vendor/libraw-wasm/worker.js` — SHA-256 `4e52d54dc2982fffbc097739083969548367fb9f8fb068af7f940b1633e005db`.

### archive-wasm 2.1.0

- License: GPL-3.0-or-later. `path.mjs` also retains the MIT notice for its slimmed-down Node.js POSIX path implementation.
- Copyright: 2023 Spacedrive Technology Inc.; Joyent and Node contributors.
- Source: <https://github.com/spacedriveapp/archive-wasm/tree/a8dc01fa220d40e180020cf37f093826f7265670> and <https://github.com/libarchive/libarchive>.
- Runtime files:
  - `scripts/vendor/archive-wasm/archive.mjs` — SHA-256 `b62e19f75f31175ca576e264987c9795ae99350bdcd6421b3d89594cb1bce544`.
  - `scripts/vendor/archive-wasm/fs.mjs` — SHA-256 `f1e4e3346d5d774e556b51a25d13f2c99148b16431bf5b8a6c0fe03bfe9d9973`.
  - `scripts/vendor/archive-wasm/path.mjs` — SHA-256 `4c8d942dcb232becf2c602832e6d964c556df05a46ed6cf2c648c3df266a7147`.
  - `scripts/vendor/archive-wasm/wasm/bridge.mjs` — SHA-256 `2021c1d7cd6a5643521c31d1f3dd02843ed63246e3f26d5277dd960b4fa5e4f7`.
  - `scripts/vendor/archive-wasm/wasm/enums.mjs` — SHA-256 `347dd37410cb88f53c3b3cb1f20d1ba05e8e19c8d66c8b5a6b1430914e6bfa95`.
  - `scripts/vendor/archive-wasm/wasm/errors.mjs` — SHA-256 `574b71da5c35eef28f80b453b0500323a6a9336cb1cfdff03b5b97d630f0fe13`.
  - `scripts/vendor/archive-wasm/wasm/libarchive.mjs` — SHA-256 `da9cf944b42b53b5c10c0d33b9d0248f24a886e4fc9cc06e10b8baa5dac6acaa`.
  - `scripts/vendor/archive-wasm/wasm/libarchive.wasm` — SHA-256 `f0c27afbae588e3bb83e817e2a0e5cdee7622f6a5b9f815896c6743e82160691`.
  - `scripts/vendor/archive-wasm/wasm/pointer.mjs` — SHA-256 `b031ddb798bbf65111eab6c49f7359af82a4d270d96dc5f7cd6a6e9f67238654`.

### 7z-wasm 1.2.0

- License: LGPL-2.1-or-later and the unRAR restriction. The unRAR-derived code must not be used to develop a RAR/WinRAR-compatible archiver.
- Copyright: Igor Pavlov; Alexandru Ciuca; Alexander Roshal for unRAR.
- Source: <https://github.com/use-strict/7z-wasm/tree/v1.2.0> and <https://www.7-zip.org/>.
- Runtime files:
  - `scripts/vendor/7z-wasm.js` — SHA-256 `f2010cb8d734cac7290a2b27278b30f2bbcd0d354f900173b4cad6b7d46a767a`.
  - `scripts/vendor/7zz.wasm` — SHA-256 `e16c6997e2eaa89575c0dd1f305074be629c3f4d87246244d37fd19debc8a285`.

### @jsquash/jxl 1.1.0

- License: Apache-2.0. The bundled JPEG XL codec is based on libjxl (BSD-3-Clause).
- Copyright: jSquash contributors; JPEG XL contributors.
- Source: <https://github.com/jamsinclair/jSquash/tree/v1.1.0> and <https://github.com/libjxl/libjxl>.
- Runtime files:
  - `scripts/vendor/jxl/jxl.mjs` — SHA-256 `1e950b7252683f99b03b9314c141a8c365e440518f19482217b1b9bcb537bbcd`.
  - `scripts/vendor/jxl/jxl_dec.wasm` — SHA-256 `165bde0f48f3bdc39c7806365db5bb3b777df67fefff48050841fb4430062433`.
  - `scripts/vendor/jxl/wasm-feature-detect.mjs` — SHA-256 `1d53972cec9992b801e7be72e5d8d6372561febb6af5f5e5920db9b3856e8826`.
  - `scripts/vendor/jxl/codec/enc/jxl_enc.mjs` — SHA-256 `321702bbb386892b2fffec718a8a480a69c22fe1af964209db7b72b78ddd9080`.
  - `scripts/vendor/jxl/codec/enc/jxl_enc.wasm` — SHA-256 `3c6c02df45c0dededab146888789d541b23b9a299cb16d497dce412a3a4bc7d3`.
  - `scripts/vendor/jxl/codec/enc/jxl_enc_mt.mjs` — SHA-256 `be19cabbb7c1592abf3c14a1be0f5f1175196add89174358ac4692e4526f2b0b`.
  - `scripts/vendor/jxl/codec/enc/jxl_enc_mt.wasm` — SHA-256 `6bb316b4e3b76fa7df5a69bd6e2508779b1c07f135dc0a52aba592fa995c72bf`.
  - `scripts/vendor/jxl/codec/enc/jxl_enc_mt.worker.js` — SHA-256 `f7f13d89617cc00ef9558880e4e61f380cd37148ce066056a3aeb7385df8a2a3`.
  - `scripts/vendor/jxl/codec/enc/jxl_enc_mt_simd.mjs` — SHA-256 `be6ea53690d595913114232d553313f89a77e3fd53719bd8a9ffe66712c4c6c4`.
  - `scripts/vendor/jxl/codec/enc/jxl_enc_mt_simd.wasm` — SHA-256 `8b5b3a537864181465e202df1913f7bbe333a168eacc48ddf945c3ce011fdb42`.
  - `scripts/vendor/jxl/codec/enc/jxl_enc_mt_simd.worker.js` — SHA-256 `0078dd59e4566dc35ce03f646c92704c3a97f97bcb82f97a437af35f751b8586`.

## Locally distributed JavaScript components

The following files are executable JavaScript without a separate WASM binary.
Each record identifies the exact local artifact and its upstream project.

| Component | Version | SPDX license | Source | Runtime file and SHA-256 |
| --- | --- | --- | --- | --- |
| ag-psd | 21.0.2 | MIT | <https://github.com/Agamnentzar/ag-psd> | `scripts/vendor/ag-psd.js` `dc9b1de9e05812ffbf8bd2db442980fe5eb78824d372a1959d029e6a3bb7600d` |
| epubjs | 0.3.93 | BSD-2-Clause | <https://github.com/futurepress/epub.js> | `scripts/vendor/epubjs.js` `fad7cc2cfc4e1439999900e33b9e127a2008e8c76a48454fd02232e8a03011a7` |
| gifenc | 1.0.3 | MIT | <https://github.com/mattdesl/gifenc> | `scripts/vendor/gifenc.js` `217761244379253ba5815510d3048a4fb1f4c4dbe9fb51a5cfbfe26f34eec093` |
| @ifc-lite/parser | 1.14.4 | MPL-2.0 | <https://github.com/LTplus-AG/ifc-lite> | `scripts/vendor/ifc-parser.js` `692b43d3d0732c756321938b69571065ff5753cf13eb9b416a0228080e0a702a` |
| js-yaml | 4.1.0 | MIT | <https://github.com/nodeca/js-yaml> | `scripts/vendor/js-yaml.mjs` `16f210b939b359b6ec8dde581eb62c157185711dc7b719b33779c43db5c31a91` |
| jszip | 3.10.1 | MIT OR GPL-3.0-only | <https://github.com/Stuk/jszip> | `scripts/vendor/jszip.js` `1ee2074b68c64ed7e7adc8b9034a7cdc77c5d718ce47572ecb9acc02de1104ad` |
| mammoth | 1.13.8 | BSD-2-Clause | <https://github.com/mwilliamson/mammoth.js> | `scripts/vendor/mammoth.js` `5fd3757e082393640e360aaa9d957ab6d3fb9255232be69dd33f8235148b7901` |
| marked | 12.0.2 | MIT | <https://github.com/markedjs/marked> | `scripts/vendor/marked.js` `288515814e901ea6535521d9fb35a1329455d3d3973de8723db998536f979cf2` |
| opentype.js | 1.3.4 | MIT | <https://github.com/opentypejs/opentype.js> | `scripts/vendor/opentype.module.mjs` `8d79d17388114a29d74681dfaed84068b1d7d9b4e39a9544fb6406d25579ad8f` |
| pdf-lib | 1.17.1 | MIT | <https://github.com/Hopding/pdf-lib> | `scripts/vendor/pdf-lib.js` `9c49b40dcf473e44b1e438301702b2436d9273eef34a2abf1daa53abe5c652f5` |
| pdf-lib-encrypted | bundled fork | MIT | <https://github.com/sico/pdf-lib-with-encrypt> | `scripts/vendor/pdf-lib-encrypted.mjs` `b551e9f561d37a580bfda1873f91692c115cbdbf8b7c0db3ac7da4660d37b6e0` |
| pdfjs-dist display | 4.0.379 | Apache-2.0 | <https://github.com/mozilla/pdf.js/tree/v4.0.379> | `scripts/vendor/pdf.mjs` `e3930e536e27fd051a05943b1887074d9e68ef1e247a71012aaf5697ce34f7e1` |
| pdfjs-dist worker | 4.0.379 | Apache-2.0 | <https://github.com/mozilla/pdf.js/tree/v4.0.379> | `scripts/vendor/pdf.worker.mjs` `f0149685b74013c3847031669db23d685369dc04e23882800246ead857010925` |
| Three.js core | 0.170.0 | MIT | <https://github.com/mrdoob/three.js/tree/r170> | `scripts/vendor/three.module.js` `ce1fa418de16a19495a9f72495580e3015d7745c296d3ce0485897f902ddedfb` |
| Three.js loaders/exporters | 0.170.0 | MIT | <https://github.com/mrdoob/three.js/tree/r170/examples/jsm> | `scripts/vendor/three-FBXLoader.js` `5000d05fd73f07bfa9090afe02f728b144d0093ca55d0f6af9a225c2d2ce0f4d`; `scripts/vendor/three-GLTFExporter.js` `4cd875fbd68d4ab2153ed0f49de48894376902b60450723cf9c4a50738c5325c`; `scripts/vendor/three-GLTFLoader.js` `42385d42271cffbb2dc0c782619458d7914a44970eb24b3f65d6aa7dc7dacc74`; `scripts/vendor/three-OBJExporter.js` `ca698d16ccfcf0007fcbdd9f63663a63857012b475a561052556cfc2202838cc`; `scripts/vendor/three-OBJLoader.js` `dd6ad869c60479312ac62092da7186deacf4e78dc339b3d5f97b49c3de7ea8cc`; `scripts/vendor/three-PLYExporter.js` `bde98c2876e80e4b92d9d546d351e453d09b6bc578cc92023fc27d465f8b7204`; `scripts/vendor/three-PLYLoader.js` `9b566cd960f8779c40c7c1af2145459ea3c2f312ee9496e275b9abf59cdd53d1`; `scripts/vendor/three-STLExporter.js` `64ee1b27a60de788c8ebca362ef97dbe2b14a2d9375cb6020794c061c1332711`; `scripts/vendor/three-STLLoader.js` `2e3bb0af19c868853ceb9ca90ccbe313e6e5433f8fb74f46a2efee79393713cd` |
| utif | 4.1.0 | MIT | <https://github.com/photopea/UTIF.js> | `scripts/vendor/utif.js` `b74249f9adb70e7759dfb31ec87941caf9a2288b6d619b913a5a814a21058ed5` |
| SheetJS / xlsx | 0.18.5 | Apache-2.0 | <https://github.com/SheetJS/sheetjs> | `scripts/vendor/xlsx.mjs` `992eec8c1a888e7f6c9b2a3cbba014bedade473da4cbd8fc9bb95de56a87f222` |

`scripts/vendor/manifest.json` is this application's import map; it is not a third-party executable artifact.

## Embedded components

These components are embedded inside a listed JavaScript bundle rather than
served as separate files. Their version is deliberately left as "bundled" when
the final artifact does not identify one.

| Component | Version | License | Copyright / source | Parent bundle |
| --- | --- | --- | --- | --- |
| pako | bundled | MIT | Vitaliy Puzrin, Andrey Tupitsin; <https://github.com/nodeca/pako> | `pdf-lib.js`, `jszip.js`, `epubjs.js` |
| fflate | 0.8.2 | MIT | 101arrowz; <https://github.com/101arrowz/fflate> | `three-FBXLoader.js` |
| localForage | 1.10.0 | Apache-2.0 | Mozilla; <https://github.com/localForage/localForage> | `epubjs.js` |
| tslib | bundled | 0BSD | Microsoft Corporation; <https://github.com/microsoft/tslib> | `pdf-lib.js` |
| tiny-inflate | bundled | MIT | Devon Govett; <https://github.com/foliojs/tiny-inflate> | `opentype.module.mjs` |
| string.prototype.codepointat | 0.2.0 | MIT | Mathias Bynens; <https://github.com/mathiasbynens/String.prototype.codePointAt> | `opentype.module.mjs` |

## Native components carried by WebAssembly distributions

The listed WebAssembly wrapper or package fixes the distributable artifact.
Where that artifact does not expose a component version, no inferred version is
recorded below.

| Component | Version | License | Copyright / source | Distributed through |
| --- | --- | --- | --- | --- |
| libjxl | inherited from `@jsquash/jxl` 1.1.0 | BSD-3-Clause | JPEG XL contributors; <https://github.com/libjxl/libjxl> | `scripts/vendor/jxl/` |
| libheif | inherited from `heic-to` 1.4.2 | LGPL-3.0-or-later | Struktur AG; <https://github.com/strukturag/libheif> | `heic-to.js` |
| libde265 | inherited from `heic-to` 1.4.2 | LGPL-2.1-or-later | Struktur AG and Dirk Farin; <https://github.com/strukturag/libde265> | `heic-to.js` |
| LibRaw | inherited from `libraw-wasm` 1.4.0 | LGPL-2.1-or-later or CDDL-1.0 | LibRaw LLC; <https://github.com/LibRaw/LibRaw> | `libraw.wasm` |
| libarchive | inherited from `archive-wasm` 2.1.0 | BSD-3-Clause | libarchive contributors; <https://github.com/libarchive/libarchive> | `libarchive.wasm` |

## Runtime CDN downloads

## Corresponding source bundles

The following component-specific source bundles are served from the same site as
the application. They are free to download without authentication and are each
limited to 25 MiB. Every bundle contains `SOURCE-METADATA.json`, a build
instruction, the source tree, and license material. `manifest.json` is the
release index and records the SHA-256 of every ZIP.

| Component | Release | ZIP | ZIP SHA-256 |
| --- | --- | --- | --- |
| FFmpeg Core / Core-MT | 2026-08-29 | `oss-source/2026-08-29/ffmpeg-core-source-2026-08-29.zip` | `27c459eea280d630117ab2d0e1c7b3fee399193f480ba0dbb7e320358221348a` |
| archive-wasm | 2026-08-29 | `oss-source/2026-08-29/archive-wasm-source-2026-08-29.zip` | `b6f71d236b23b86f3ee3aa1eb40aa289663cf04a23fd39386f240b794504d83a` |
| heic-to | 2026-08-29 | `oss-source/2026-08-29/heic-to-source-2026-08-29.zip` | `7b5f9de5eab029f9560a9f6481391cc644710bfd4098659651a1fa9a731bc556` |
| libraw-wasm | 2026-08-29 | `oss-source/2026-08-29/libraw-wasm-source-2026-08-29.zip` | `68089c1770183895a6e0e7a8bbc28924aab08bb9aade77462fc6b5b7c0bb581f` |
| 7z-wasm | 2026-08-29 | `oss-source/2026-08-29/7z-wasm-source-2026-08-29.zip` | `5771aa74f1f22561c776f6bf52a368cf560680bb0a86802f0480a4eb8aa84981` |

The source-bundle release manifest is `oss-source/2026-08-29/manifest.json`.

### FFmpeg WebAssembly

- Components: `@ffmpeg/core` 0.12.10 and `@ffmpeg/core-mt` 0.12.10.
- License: GPL-2.0-or-later.
- Source: <https://github.com/ffmpegwasm/ffmpeg.wasm/tree/v0.12.10> and <https://ffmpeg.org/legal.html>.
- URLs: version-pinned `ffmpeg-core.js`, `ffmpeg-core.wasm`, and, for the multithread build, `ffmpeg-core.worker.js` under `https://unpkg.com/@ffmpeg/`.
- The application and service worker reject and do not cache responses whose SHA-256 differs from the following values:
  - `@ffmpeg/core` `ffmpeg-core.js` — `67a48f11645f85439f3fde4f2119042c16b374b910206b7a7a24f342e28dcae3`.
  - `@ffmpeg/core` `ffmpeg-core.wasm` — `9f57947a5bd530d8f00c5b3f2cb2a3492faa7e5d823315342d6a8656d0a6b7b7`.
  - `@ffmpeg/core-mt` `ffmpeg-core.js` — `270a2e6ff945e173238610669a3f7132df5f9c52698a9bf708cf5c2ab6bda0de`.
  - `@ffmpeg/core-mt` `ffmpeg-core.wasm` — `be2c97605366b78f3f13e21b52e81a55a79e1f29c133b03a68ec187b1a2ec41a`.
  - `@ffmpeg/core-mt` `ffmpeg-core.worker.js` — `f77898d631dc010b45c29c23cb4379c611a7d7b131bf591d08a656bb729a4ca3`.

## Development metadata

The following files are shipped as repository metadata but are not imported at runtime: `scripts/vendor/archive-wasm/**/*.d.mts`, `scripts/vendor/libraw-wasm/index.d.ts`, and `scripts/vendor/libraw-wasm/{index,libraw,worker}.js.map`.